Vector35 / Vector35/binaryninja-api
Ability to found `or`ed constants even if no enumeration type is set
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
I'm not sure if this is a bug or missing feature. In the example below 0xf0 actually means PAGE_EXECUTE_WRITECOPY|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_READ|PAGE_EXECUTE but I cannot set that value to enumeration. It would be very useful if BN can do that when I try to set enumeration with M shortcut.
int64_t query_mem_info(int64_t addr)
MEMORY_BASIC_INFORMATION lpBuffer
VirtualQuery(addr, &lpBuffer, 0x30)
if (lpBuffer.State == MEM_COMMIT && (lpBuffer.Protect.b & 0xf0) != 0) {
return 1
}
return 0
Actually I found other examples where BN automatically did that. For example:
uint32_t uMode = SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOOPENFILEERRORBOX)
SetErrorMode have a type like this: uint32_t SetErrorMode(enum THREAD_ERROR_MODE uMode). So I assume BN do this automatically if enumeration type is set. I tried to change the type of Protect from DWORD to PAGE_PROTECTION_FLAGS but it didn't work. Also I don't think that this should be the solution for this issue, instead, BN should be able to do it even if there is no enumeration type is set.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the M shortcut's enumeration-setting path and compare its handling with the existing behavior for typed enumerations, using the PAGE_PROTECTION_FLAGS and SetErrorMode examples in the report. Done means an ORed constant value such as 0xf0 can be recognized as its constituent enumeration flags even when no enumeration type is assigned.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100